CVE-2017-8861
📋 TL;DR
The Cohu 3960HD video inspection system has an unauthenticated remote configuration vulnerability on port 1236/tcp. Attackers can send specially crafted XML SOAP packets to change critical configuration parameters including IP addresses and credentials. This affects all systems running vulnerable versions of the Cohu 3960HD software.
💻 Affected Systems
- Cohu 3960HD
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover where attackers change IP configuration and credentials, permanently locking out legitimate administrators and potentially redirecting video feeds to malicious destinations.
Likely Case
Unauthorized configuration changes leading to service disruption, credential theft, and potential lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to port 1236/tcp.
🎯 Exploit Status
Exploitation requires only network access to port 1236/tcp and knowledge of the SOAP XML format.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Cohu for specific patched version
Vendor Advisory: https://www.cohu.com/
Restart Required: Yes
Instructions:
1. Contact Cohu support for the security patch. 2. Apply the patch following vendor instructions. 3. Restart the system. 4. Verify port 1236/tcp now requires authentication.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to port 1236/tcp using firewall rules
iptables -A INPUT -p tcp --dport 1236 -j DROP
VLAN Segmentation
allIsolate Cohu 3960HD systems on separate VLANs with strict access controls
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Cohu systems from untrusted networks
- Deploy intrusion detection systems to monitor for SOAP XML traffic on port 1236/tcp
🔍 How to Verify
Check if Vulnerable:
Attempt to send SOAP XML configuration change request to port 1236/tcp without authenticationCheck Version:
Check system firmware version through device web interface or consoleVerify Fix Applied:
Verify that SOAP XML requests to port 1236/tcp now require authentication and reject unauthenticated requests📡 Detection & Monitoring
Log Indicators:
- Unauthorized SOAP XML requests on port 1236
- Configuration changes without authentication logs
Network Indicators:
- SOAP XML traffic to port 1236/tcp from unauthorized sources
- Multiple configuration change attempts
SIEM Query:
source_port:1236 AND protocol:TCP AND (payload_contains:"SOAP" OR payload_contains:"XML")